Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2024 18:01
Behavioral task
behavioral1
Sample
dc444ad33b8902a32a733b37e7fe63f1.dll
Resource
win7-20240220-en
4 signatures
150 seconds
General
-
Target
dc444ad33b8902a32a733b37e7fe63f1.dll
-
Size
556KB
-
MD5
dc444ad33b8902a32a733b37e7fe63f1
-
SHA1
447c9406314520914478aecf836d5f2880c46b5b
-
SHA256
1ae3ab46cbff2777115e5026a1066d48edef9b2e2bec30a9e5a9507d7e7f4c8a
-
SHA512
176c41251d764b9e590b6fd4aed62068504d7ed5c5889da1836244be0740fd8a0940050c0338c1458ff81bf2c03de9deb044487acc16a02214c5e32d038b24c1
-
SSDEEP
12288:mQbIiJRNZEg9mgLQamuAZ4NsWLlNrUVFuOL/CE888888888888W88888888888yc:PfZN9ca9nNvD2AdW1HGK/
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EFDB823E-2483-4203-A6EB-50F66303C5BA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EFDB823E-2483-4203-A6EB-50F66303C5BA}\ regsvr32.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EFDB823E-2483-4203-A6EB-50F66303C5BA}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dc444ad33b8902a32a733b37e7fe63f1.Q regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EFDB823E-2483-4203-A6EB-50F66303C5BA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dc444ad33b8902a32a733b37e7fe63f1.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EFDB823E-2483-4203-A6EB-50F66303C5BA}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EFDB823E-2483-4203-A6EB-50F66303C5BA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EFDB823E-2483-4203-A6EB-50F66303C5BA}\ = "S" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EFDB823E-2483-4203-A6EB-50F66303C5BA}\ProgID\ = "dc444ad33b8902a32a733b37e7fe63f1.Q" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EFDB823E-2483-4203-A6EB-50F66303C5BA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dc444ad33b8902a32a733b37e7fe63f1.Q\ = "S" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dc444ad33b8902a32a733b37e7fe63f1.Q\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dc444ad33b8902a32a733b37e7fe63f1.Q\Clsid\ = "{EFDB823E-2483-4203-A6EB-50F66303C5BA}" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3812 wrote to memory of 3084 3812 regsvr32.exe 90 PID 3812 wrote to memory of 3084 3812 regsvr32.exe 90 PID 3812 wrote to memory of 3084 3812 regsvr32.exe 90
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\dc444ad33b8902a32a733b37e7fe63f1.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\dc444ad33b8902a32a733b37e7fe63f1.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:3084
-